https://guardianvigil.io/research Notes on threat intelligence scoring, detection engineering and interface design. en https://guardianvigil.io/research/a-failed-lookup-is-not-a-clean-verdict https://guardianvigil.io/research/a-failed-lookup-is-not-a-clean-verdict The most dangerous line in a threat scanner is the catch block. We have found and removed the same defect twelve times in IntelStack: a provider call fails, and the scanner reports the indicator as clean. Open Source Mon, 24 Aug 2026 05:00:00 GMT https://guardianvigil.io/research/not-every-provider-means-the-same-thing https://guardianvigil.io/research/not-every-provider-means-the-same-thing Most multi-source scanners count votes. But a MalwareBazaar hit means somebody submitted the actual binary, and a GreyNoise hit means the address scans the internet. Treating those as equal votes produces confident nonsense. Threat Intel Wed, 12 Aug 2026 05:00:00 GMT https://guardianvigil.io/research/designing-for-analysts-who-are-already-tired https://guardianvigil.io/research/designing-for-analysts-who-are-already-tired Interface decisions in a security console are not aesthetic. A monospace font prevents an l/1 confusion in an indicator, and a colour choice decides what an analyst believes before they have read a word. Open Source Tue, 28 Jul 2026 05:00:00 GMT